Search the public rule index by CVE, GHSA, CWE, language, framework, author, or rule slug. Filter by language, framework, severity, confidence, license, and validation status.
A URL object is instantiated to validate the path, but the host is not verified. Attackers can supply protocol-relative paths (e.g., `//evil.com`) which resolve against the current base URL and pass protocol-only checks. If the unvalidated path is then used for navigation, it results in an Open Redirect.
Detected a TypeORM query using an unscoped OR condition to fetch potentially private or sensitive records globally. In TypeORM, an array in `where` is interpreted as an OR condition. Providing an object restricted only to the type (e.g., `{ type: 'personal' }`) or using a `.where().orWhere()` chain lacking explicit `AND` constraints fails tenant separation,
Reconstructing a relative URL directly from `URL.pathname` without sanitizing leading slashes can lead to Open Redirect vulnerabilities. When parsing user input with a dummy base, inputs like `/.//evil.com` normalize to a pathname of `//evil.com`. If this is used in a navigation or redirect, it is treated as a protocol-relative URL to an external domain. Col
Direct assignment of joined array content to innerHTML or outerHTML bypasses HTML encoding and can lead to Cross-Site Scripting (XSS). If the array contains untrusted or user-controlled input, such as unescaped component slots, an attacker can execute arbitrary scripts via implicitly closed tags. Use textContent instead to safely encode the data as plain tex
The code relies on blocklisting specific HTML tags or attributes (such as `[onerror]` or `[href^=javascript]`) to sanitize untrusted input. This approach is inherently incomplete and easily bypassed by attackers using different executable constructs (e.g., `srcdoc`, `formaction`, data URIs). To properly sanitize HTML, use a well-tested library like DOMPurify
User-controlled input is decoded with `decodeURI` or `decodeURIComponent` and flows into a path construction or filesystem operation. Encoded traversal sequences (like `%2e%2e%2f`) can bypass initial checking logic, leading to directory traversal or arbitrary file access once decoded. Ensure that paths are validated *after* decoding, for instance by checking
Recreating a session token without explicitly deleting the previous session from the token store can result in insufficient session expiration. Orphaned session identifiers may remain fully privileged, allowing session hijacking. Ensure the old session is deleted (e.g., typically via `$TOKEN.del()`) before generating and assigning a new one.
A plain object `{}` is used as a dictionary map for objects from an array, with a key derived directly from the object's properties. If the key is controlled by an attacker (e.g., `__proto__`), this can lead to Prototype Pollution. Use `Object.create(null)` to safely store items without inheriting from `Object.prototype`.
Constructing paths directly from unvalidated dynamic properties (such as `.host` and `.path` from URIs) or appending arguments after a cryptographic hash in `path.join()` allows directory traversal. This nullifies the isolation of the predictable hash component and allows writing files to arbitrary locations. Always resolve external input safely using `path.
Unintended OR condition in TypeORM `where` or `orWhere` statement. The query combines a user-specific constraint with a generic `type` check, resulting in an OR logic that inadvertently scopes access to all records matching the generic type. This leads to BOLA and improper access control.
A TypeORM query uses an array for the `where` clause (creating an OR condition) but the `{ type: 'personal' }` filter is missing a user or tenant constraint. This exposes all personal projects across the platform regardless of the user.
Detected a TypeORM query using an OR condition to combine a global property check with a user ID constraint. Using an array in the `where` option or chaining `.orWhere()` creates an OR condition. If the global property was intended to scope the user's data rather than grant global access to that type, this results in broken access control. Verify the logic s
Insecure OR query exposing all personal projects due to array syntax in TypeORM `where`.
The JWT signing function defaults to a symmetric algorithm (like 'HS256') and subsequently places it in the token header, but fails to check if the provided private key is an asymmetric JSON Web Key (JWK) containing its own structured 'alg' (algorithm) property. This allows for algorithm confusion attacks where an asymmetric key is mistakenly processed as a
A JWT signing function fails to extract `alg` and `kid` from a JWK private key object. This may lead to algorithm confusion vulnerabilities if a default symmetric algorithm is used for an asymmetric key.
The JWT signing function creates a token header using a provided or default algorithm parameter without verifying if the provided key object contains its own native 'alg' or 'kid' properties. When a JSON Web Key (JWK) is passed natively to this signing function, it may be used with a mismatched symmetric algorithm (e.g., 'HS256'), leading to severe algorithm
The JWT `sign` function generates a token header using a separate algorithm parameter rather than extracting the algorithm and Key ID directly from the private key object. This omission leaves the framework vulnerable to algorithm confusion during verification because the algorithm and key are not cryptographically bound together.
The `formatDate` function lacks an explicit length check on the `format` parameter. This can lead to memory exhaustion and Denial of Service (DoS) due to continuous regular expression evaluation loops down the execution path.
The application retrieves an element by ID and parses its text content without checking its `tagName` or `nodeName`. This is susceptible to DOM clobbering, where an attacker can inject a malicious element with the targeted ID (e.g., `<div id="...">`) to bypass type assumptions and poison the parsed JSON payload. Perform validation to ensure the retrieved ele
Forwarding request headers directly to a new fetch or Request object without sanitizing sensitive headers (like 'Authorization' or 'Cookie') can cause a credential leak during cross-origin requests or redirects. Ensure you extract and sanitize headers if the destination origin differs from the source.
Detected unsanitized input flowing into a filesystem operation. This can lead to Path Traversal and remote code execution if an attacker can manipulate the path. Ensure the path is resolved and validated against a known base directory using `path.resolve` and `startsWith`.
An Axios request uses an overly permissive `validateStatus` function that permits HTTP 3xx status codes (e.g., `< 400`). When fetching untrusted URLs, accepting redirect statuses as successful resolutions can allow an attacker to bypass Server-Side Request Forgery (SSRF) protections or proxy unexpected content. Enforce explicit `maxRedirects` constraints and
Undocumented webBookmarkResignImage action enables SSRF/IDOR via metadata URL extraction and customized PresignedUrl generation
Selecting a component host element dynamically using `selectRootElement` with a variable selector bypasses tag name validation and allows XSS. Attackers could direct the component to mount onto a `<script>` tag, resulting in script execution when internal properties are rendered natively. Ensure that the selected element's `tagName` is re-validated against `
